December 2025 Minutes

• 2026 Meeting Schedule: Proposed shift to midday US Eastern to accommodate global staff and Charity CFO participation.

• Director of Corporate Relations Search:

  • 483 applicants received
  • Screening underway; community applicants to be interviewed where appropriate

• January 2026 In-Person OWASP Board Strategy Meeting in Amsterdam Planning:

  • Hotel coordination underway
  • Board members reminded to finalize travel promptly due to rising costs
  • No concrete plans to be present at FOSDEM

• Annual Impact Report:

  • Stacey is working on the report
  • Rebranded from “Annual Report”
  • Target publication before January 2026 Board meeting

• Audit & Compliance:

  • 2024 audit completed with a clean opinion and posted on the OWASP website
  • IRS Form 990 completed and published on the OWASP website
  • Banking concentration risk noted, but no immediate change recommended

• OWASP EU Entity - OWASP Operations Europe:

  • Entity formation progressing
  • Banking setup delayed
  • VAT obligations to be addressed upon bank account activation

• Security & GitHub Risk:

  • Recent industry attacks reviewed (Shai-Hulud worm)
  • OWASP repositories not impacted
  • Planned risk assessment and review of GitHub Actions, branch protections, and credential hygiene

• 2026 Board Officers Election meeting on January 5th

  • Andrew and Sam to check bylaws regarding the meeting
  • Dawn advised that some newly elected Board members have not yet submitted required onboarding paperwork. Board members who have not completed all required documentation by January 5, 2026 will not be eligible to vote in the officers election.

• Cash Position decreased by $203K. Ending balance: $1,754,875

• ~4.68 months cash on hand (excluding CDs)

• Certificates of Deposit: Recommended rollover; Board expressed agreement

• Events:

  • Global AppSec DC Conference 2025 exceeded profitability expectations
  • $50,000 refund pending

• Accounts Receivable: $162,000 total; minimal aging risk

Background Lauren Thomas will provide an update on the forthcoming UK Training Days event, including planning progress, speaker lineup, and promotional activities, and how the Board can help promote the event.

• Lauren provided an update on the UK Training Days event scheduled for February 25-27th .
• Registration was opened shortly before the Thanksgiving holiday period.
• Initial registrations have been slow, which was noted as expected due to the holiday season.
• Marketing and promotion efforts are ongoing, with expectations that registrations will increase after the holidays.

Background The Board will discuss a proposal to modify the Membership Policy to add specific benefits for Distinguished Lifetime Members. This change aims to recognize and reward long-term commitment and contributions to OWASP.

• Draft pull request for Membership Policy changes
• The proposal will be submitted to the Policy Review and Community Review and to undergo additional refinement based on feedback
• The Board agreed to revisit the proposal for a vote at the January 2026 Board meeting.

Background Andrew van der Stock will provide an update on the progress of the OWASP website redesign project, including key milestones, challenges faced, and next steps.

• Website reported as ~95% complete.
• Launch blocked pending required Next.js security update.
• Penetration testing to occur after update completion.
• Board requested an opportunity to review prior to launch.
• Vendor SLA for vulnerability remediation to be formalized.

Background Andrew van der Stock will provide an update on the planning for OWASP's 25th Anniversary celebrations, including upcoming events, marketing efforts, and community engagement activities.

• Global and chapter-based events planned throughout 2026.
• Chapter-hosted anniversary celebrations underway.
• Request made for a centralized anniversary page or microsite.
• Board encouraged to amplify anniversary messaging via social media.

Background Stacey Ebbs will lead a discussion on OWASP's marketing strategy, including current initiatives, future plans, and how the Board can support these efforts.

• Comprehensive H1 2026 marketing plan presented.
• Focus areas include:
  • Membership growth
  • Corporate supporters
  • Social engagement metrics
  • Anniversary campaign integration

Background Avi Douglen has led a proposed change to the Election policy, creating a Board of Directors Policy, creating a new draft policy for consideration. This policy has received feedback from the community, which has been incorporated into the current draft by the Policy Review Team. The new policy proposes stronger qualifications for candidates, conflict-of-interest clarifications, and ranked-choice voting (STV). The director qualifications in the new policy is not applicable to the 2025 elections for Director qualifications, but the new seating procedure will be used for the 2026 Directors.

Motion "Resolved, that the Board approves the Board of Directors Policy, replacing the existing Election Policy, effective immediately."

• Draft Policy
• Feedback as a PR
• Feedback Summary

Sponsor: Avi Douglen Second: Harold Blankenship

Vote:

• Steve Springett – YES
• Harold Blankenship – YES
• Sam Stepanyan – YES
• Ashwini Siddhi - YES
• Avi Douglen - YES
• Diego Silva Martins – YES
• Ricardo Griffith – YES

Result: The Vote PASSES, 7–0

Motions to amend the bylaws: "Resolved, the OWASP Foundation Bylaws are amended to reflect the change from the Election Policy to the Board of Directors Policy, including removing references to the old Election Policy, effective immediately."

• Bylaw Change Pull Request

Sponsor: Avi Douglen Second: Ricardo Griffith

Vote:

• Steve Springett – YES
• Harold Blankenship – YES
• Sam Stepanyan – YES
• Ashwini Siddhi - YES
• Avi Douglen - YES
• Diego Silva Martins – YES
• Ricardo Griffith – YES

Result: The Vote PASSES, 7–0

Motion to approve the antitrust policy "Resolved, that the Board approves the Antitrust Policy, which is required to ensure compliance with US antitrust laws, effective immediately."

• Draft Antitrust Policy

Sponsor: Avi Douglen Second: Diego Martins

Vote:

• Steve Springett – YES
• Harold Blankenship – YES
• Sam Stepanyan – YES
• Ashwini Siddhi - YES
• Avi Douglen - YES
• Diego Silva Martins – YES
• Ricardo Griffith – YES

Result: The Vote PASSES, 7–0

Background The Board will review the accomplishments of 2025, thank departing Board members, and a social gathering to celebrate the end of the year.

The Chair and Board members expressed appreciation to:

• Departing Board members Avi Douglen and Diego Silva Martins
• OWASP staff for continued operational excellence

The Board will potentially adjourn to a closed executive session to discuss confidential matters. Only Board members and invited guests will attend.

• NOTE: The Board did not enter executive session during the December 2025 meeting.